CR4 with wires, no QSB, no debug light no glitch.

[sirredz]

Trying my 2nd CR4 install, my 1st install was on a Corona 4gig V2 and I didn't have the R/W kit, so I bailed out and started on my Jasper 16mb (Elite 120gig)

Console Type: Jasper 16mb
Programmer Used: NAND-X
NAND Size: 16mb
Dashboard version:13599
CB Version: 6750

Detailed Description of the Problem
** No glitch at all, no green debug light and not able to boot to retail dash after re-flashing back to original dump. (I get 3 RROD)

Was the console working before you started: Y - no issues
Do you get a green debug light appear on the CR4 XL chip every 4-5 seconds: NO

Jrunner Log (one of my attempts)
----
Glitch2 Selected
* unpacking flash image, ....
Spare Data found, will remove.
Removed
* found decrypted CD
* found XeLL binary, must be linked to 0x1c000000
* we found the following parts:
SMC: 2.3
CB_A: 6750
CB_B: missing
CD (image): 8453
CD (decrypted): 8453
* this image will be valid *only* for: jasper (CB_6750)
* patching SMC...
Patching Jasper version 2.3 SMC at offset 0x12BA
* zero-pairing...
* constructing new image...
* encrypting CB...
* encrypting CD...
* base size: 70000
* No separate recovery Xell available!
* Flash Layout:
0x0..0x1FF (0x200 bytes) Header
0x200..0xFFF (0xE00 bytes) Padding
0x1000..0x3FFF (0x3000 bytes) SMC
0x4000..0x7FFF (0x4000 bytes) Keyvault
0x8000..0x11A3F (0x9A40 bytes) CB_A 6750
0x11A40..0x17A3F (0x6000 bytes) CD 8453
0x17A40..0xBFFFF (0xA85C0 bytes) Padding
0xC0000..0xFFFFF (0x40000 bytes) Xell (backup)
0x100000..0x13FFFF (0x40000 bytes) Xell (main)
* Encoding ECC...Done!
------------- Written into output\image_00000000.ecc

Version: 03
Flash Config: 0x00023010
Writing Nand
image_00000000.ecc
Done!
in 0:11 min:sec

I am very confused -- having J-tagged 12+ Xenons (old RROD repairs) and installing a CR3 in a Zenon way back, I thought I would be able to get through this. Surely I have made a silly mistake here...

Thanks in advance.

 

[BL4K3Y]

Did you remove 5V from the CR4 before testing the stock NAND image?

 

[sirredz]

Thanks for the quick reply.

Yes, I did. Same result with and without +5V. Do I need to remove the diodes? I seem to recall needing to remove them in the past to boot the stock nand.

Glitch is auto-selected by J-Runner when selecting the latest dash (17150) or (17148). I noticed when I manually select Glitch2 the CR4 option is presented. I have tried all three variants.

Originally I caught my grey wire had come loose, I found it on my initial troubleshoot and re-secured it. Any other ideas?

 

[joshypoo]

If your console was on 13599 Dashboard why dont you just make a RGH1 image?

i might be wrong on this but i dont think you can make a RGH2 image on a Single CB kernel( hence why you dont even get a debug light)

So if you want to use the CR4 then you need to update the console to a split CB kernel and dump you nand again and make a new image

or remove the cr4 and use a CR rev a/b/c or cr3 lite if you want to keep it on a single CB kernel

 

[sirredz]

Found the issue! A nice little solder bridge under the grey wire, !!! so hard to see without the microscope -- Fixed it with some desolder wick and retail nand booted right away! Unfortunately I removed the CR4 entirely to find the answer.

Anyone doing more than one of these glitch chips, invest in the USB microscope indeed!!!! and a GOOD soldering iron/clean tip. (Near TP7R3 on second last picture) - I hope this helps someone else find their mistake!

 

[sirredz]

Hi Joshy-- Thanks for the reply. Way above my head. The CR4 has been removed and I have tracked down my issue, whats the advantage of the RGH1 image? (now called glitch) if I understand correctly.

Glitch = RGH1
Glitch2 = RGH2 (shows option for CR4 when selected)
Glitch 2m = ?

I have CR3lite boards here, would that be a better choice? Have to admit I was a little excited to get to my 1st CR4 install.... (working)

 

[joshypoo]

RGH1 is FAST! but if you ever decide to do a demon install with a freeboot/retail setup then you will have to switch to RGH2,RGH2+ or R-JTAG, R-JTAG+

Yes your correct on the Legend you made for Glitch images

Glitch2m i honestly do not know never used it. might be wrong but i think it had something to do with the DGX and getting the cpukey the old way on Slims. not needed anymore.

If you want to use your CR4 you need to update your console to 14699 Dash and up. Glitch 2 is for split Cb 14699 and up. Glitch 1 is for single Cb 14699 and under.

 

[jsinger47]

Since you said you were on 13599, you will NOT be able to use RJTAG on CR4.

You could use RGH2, though.

RGH2 will work on any dashboard, contrary to what joshypoo was saying.

 

[joshypoo]

jsinger, so you can run a RGH2 image on a single CB nand?

 

[jsinger47]

jsinger, so you can run a RGH2 image on a single CB nand?

Well, the NAND won't be single CB (as you'd put a split CB on there).

But no, you don't need to burn the split-CB efuses in the CPU in order to run RGH2.

RGH2 works on any dashboard.

 

[joshypoo]

Ok thank you for the correction.

 

[sirredz]

Since you said you were on 13599, you will NOT be able to use RJTAG on CR4.

You could use RGH2, though.

RGH2 will work on any dashboard, contrary to what joshypoo was saying.

I took advise above and updated my console on XBL, to 17150. I then began the process of reinstalling the CR4, which I did successfully this time. Can't stress enough the value of a clean/good condition solder tip and solder braid/wick to clean up mistakes. These points are very small for which I am thankful I had my USB microscope.

Interestingly enough, using Nand-X and Jrunner, I saved my original 13599 nands, archived them, re-read the console with the 17150 dash, 3 times. It auto-selected the Jtag option, I build the Xell Reloaded image, and wrote it. It instant booted and I connected my Cat5e and pulled the CPU key per usual. Following the process as norm, I clicked on Create Xebuild image, where I received " 1BL appears to be incorrect " all others seem fine. Wrote the image, and nothing.

I have seen the 1BL not correct on a previous attempt at something else, so I thought I would try to boot to Xell also - nothing.

Not sure why I did this, but I reconnected the Nand-X and decided to click on WRITE XELL (keeping in mind my original nanddump1.bin was still in the source file path.) After writing Xell again, not only did the console Instaboot the dashboard, my second attempt to boot via eject t Xell also worked.

2-5 attempts to boot Dash and each time it appears to be insta-boot EVERYTIME.

Thank you to Team Xecuter, and C4Eva, and every single person here and abroad who have made this all possible. I wish I could understand this all a lot better, but for now, I'll just be happy with my results.

I also grabbed my Jtag FSD3 HDD and connected it, sure enough it booted right to the FS dash.

Can anyone take a shot at explaining the 1BL key error, and why re-writing Xell (??) seemingly fixed it?

Thanks all!